hxxps://www[.]youtube[.]com/watch?v=tKTZALMTvxM

Analysis

user interaction
yes
max time kernel
259s
max time network
240s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com/watch?v=tKTZALMTvxM
Sample260825-s32jca1ybz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321460015120876"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{D2B5F656-950C-4B91-87B6-6D365B1FA9A0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{43187474-3FB7-4E16-8815-A4CDBE445EC1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3840	4420	msedge.exe	87
PID 4420 wrote to memory of 4144	4420	msedge.exe	88
PID 4420 wrote to memory of 696	4420	msedge.exe	89
PID 4420 wrote to memory of 4144	4420	msedge.exe	88
PID 4420 wrote to memory of 4144	4420	msedge.exe	88
PID 4420 wrote to memory of 2760	4420	msedge.exe	90
PID 4420 wrote to memory of 2760	4420	msedge.exe	90
PID 4420 wrote to memory of 4440	4420	msedge.exe	92
PID 4420 wrote to memory of 4440	4420	msedge.exe	92
PID 4420 wrote to memory of 4440	4420	msedge.exe	92
PID 4420 wrote to memory of 2068	4420	msedge.exe	93
PID 4420 wrote to memory of 2068	4420	msedge.exe	93
PID 4420 wrote to memory of 2068	4420	msedge.exe	93
PID 4420 wrote to memory of 2844	4420	msedge.exe	94
PID 4420 wrote to memory of 4940	4420	msedge.exe	95
PID 4420 wrote to memory of 2844	4420	msedge.exe	94
PID 4420 wrote to memory of 2844	4420	msedge.exe	94
PID 4420 wrote to memory of 4940	4420	msedge.exe	95
PID 4420 wrote to memory of 4940	4420	msedge.exe	95
PID 4420 wrote to memory of 4260	4420	msedge.exe	96
PID 4420 wrote to memory of 4260	4420	msedge.exe	96
PID 4420 wrote to memory of 4260	4420	msedge.exe	96
PID 4420 wrote to memory of 4816	4420	msedge.exe	99
PID 4420 wrote to memory of 4816	4420	msedge.exe	99
PID 4420 wrote to memory of 4816	4420	msedge.exe	99
PID 4420 wrote to memory of 4392	4420	msedge.exe	100
PID 4420 wrote to memory of 4392	4420	msedge.exe	100
PID 4420 wrote to memory of 5076	4420	msedge.exe	101
PID 4420 wrote to memory of 5076	4420	msedge.exe	101
PID 4420 wrote to memory of 528	4420	msedge.exe	102
PID 4420 wrote to memory of 528	4420	msedge.exe	102
PID 4420 wrote to memory of 1480	4420	msedge.exe	104
PID 4420 wrote to memory of 5108	4420	msedge.exe	107
PID 4420 wrote to memory of 988	4420	msedge.exe	117
PID 4420 wrote to memory of 4276	4420	msedge.exe	118
PID 4420 wrote to memory of 4332	4420	msedge.exe	119
PID 4420 wrote to memory of 3828	4420	msedge.exe	123
PID 4420 wrote to memory of 3828	4420	msedge.exe	123
PID 4420 wrote to memory of 2024	4420	msedge.exe	125
PID 4420 wrote to memory of 3240	4420	msedge.exe	126
PID 4420 wrote to memory of 3240	4420	msedge.exe	126
PID 4420 wrote to memory of 1636	4420	msedge.exe	127
PID 4420 wrote to memory of 1636	4420	msedge.exe	127
PID 4420 wrote to memory of 100	4420	msedge.exe	128
PID 4420 wrote to memory of 100	4420	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/watch?v=tKTZALMTvxM
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffe07abc188,0x7ffe07abc194,0x7ffe07abc1a0
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,6977613459262237105,11515166466375296983,262144 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12934613592763858017,13439907025420819481,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:3
  2⤵
  - System Time Discovery
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,18229556604961943089,17025567226715950272,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,5005585959314284715,18119335234915596809,2097152 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10086657307116818605,14695885587899061017,2097152 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,8021228186967224651,15227740346745748758,2097152 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,18016725825544751462,8793988500919019675,2097152 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,5709363652944392757,13800652652507475527,2097152 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5232,i,10331293071526590693,10679072687455717341,2097152 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,1020414747037023329,17822459342666647122,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,13894651857157216339,6771996348656136371,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,15828682737224000504,2585372479507227339,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,14844671862353312807,417621354353075520,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,11880954178080393226,7783031761745157918,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,11880954178080393226,7783031761745157918,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,7835921543742939498,7127412741506333800,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,14236755430712998952,2402149709669814029,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,16249722618661376992,3946576777940330266,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,15338701843891452606,17013726885899578772,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6528,i,213756444591024357,10176023285972103143,262144 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,11213442122937917037,16221824500279640408,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,18318331300413448505,18213603745860499121,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,4042386366460185471,9610286329498445838,524288 --field-trial-handle=2732,i,7982821177154465716,16099629955453024058,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 13f39d775e8691fa26ee710121b1170b035f7a7250a8e7b57872da475da8a5bc
MD5 15e23a776ba865d1d9ff08706150b246
SHA1 5bec47c75f8d4903d0f0a448cd3ae4c65ac95190
SHA512 d2a7f956c62795191f7b4227bd1b88be4d301b30bcf61c28547091ec083d5b0a1f18c412bfef2a5a88ad35f53d8a5d05cba74023fd752464dc2661fbf12fe474
TLSH
T10A71E7FD27A108E2DB59407574E21A44747CBDD6F53F7E4E136048F52212FA18F0A28C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591061.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591061.TMP
Size 3KB
SHA256 b508edede9a5508e7d45bf0c045c850568dbc44176bbaca503042d5dc58199f1
MD5 648e9c52ecbcfa192b70bb061b658ac8
SHA1 6f4b2d8b096207a9fbb086b335db77dcf86530f5
SHA512 c238af3bb44febd301c9670468d474f2ff6a276a180edd49e365d74eb7782db7722cd93a2fda10dd9b3ceb726fb436dcd0f786ba8ccc2aa54b87176848b665d5
TLSH
T1D361F8FD176208E1E7694071B0E20644747C3EEAF93F7E8E535048FA6616F668F5928C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 261KB
SHA256 27f9d8a32dd8749ba3f23fa8d84d77efa3699e19596555de8760594a6c7422bf
MD5 6b032b52105455743141b1ac7999edcc
SHA1 f1a82b27d6ead45ba2a8262e37ea4fc95f81ab61
SHA512 9b11494e719ef4bc2734be94851c3fb2f4a57f74692d06eb071816c3f137e26218cbcc5c8ffa7241095a6fa8bb3e1a15e92103f16e40e3267b08ea56b249f9a0
SSDEEP 3072:7ec5LPToAKPqnBczbciPVxWM86TZ/f0C2VH8FTHDgBGfKPs:Fe
TLSH
T19944DA2872E373E5E039C33B15218C47D3B697C8995D7096B4727E0C26FBB593AA4329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 4048dec74054c76e8931f9b48c18db7830ecdf7294413b219affa9dba0e0674e
MD5 f7cea2f34f5a11b102d48a9f262dd870
SHA1 f562d9ee6b87cccb168b73ad71c49d2c02a49cbf
SHA512 5db515b8855507583ba37b8d722df1cde42a5f10f9cdc5b390f11dcc863d677d220a4a9f68d50358107da17d74853c15fce35ef591334351fdbfce09656c4703
TLSH
T199E0202CCDCBC25F616465EB65357B0DE69BB60ED7CCFD450F45C804705614CD46E151
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 f7974a67da01cdbe62a2823b52c15ed51bd2cf23e03b5d266a8fd4cba955e623
MD5 aad1ff263eae310e01df21124340dedc
SHA1 4096f2cb2b197ee9453dbe8bb4423afd75983648
SHA512 ca34f213e4e454d5787d7ffddf83a4b1cbf15f8b43fbbf1ba25cff5ff7bde88500c4b7662305b017288c7f2c09805e305b8aec50de12b0c82c42da3233b2a067
SSDEEP 96:DhOuCVue1Vuf3ueuouEuWuCutuBz/uQ1/uASu+u5OuTugfusy7u3uauZVunuQ3wd:DU/fyF/x/BAebV3SvNSzAA9mVUbOHx
TLSH
T17BC188E2C3D4822DD82516F09B583D1BDE6D0E24C3583C7AD9D6BF4B93EA031E245A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9c9399b31042b8be5d3d3e0ef574cc19ef6c61449a3fefd2059e0293d0333bb3
MD5 cf56798bb44e9ea4903f952e49c2a054
SHA1 de57d735b62eea08eebf93169de2c4801fbe955f
SHA512 9d09ea2ada2870447dc0f5b67702eb4f7d0c336da67517c64e4f0475155a39bfba33aea2dcd0a748fe498e2c05b5c11a528e7d87ec73416d249b962dbaf59977
SSDEEP 192:sxZpR8yM/jK1Ml8Mkt/fVsS8y7Idp0Kg/ElHW6+WNnbpK/Y9IFiLPIgrJ:sxZpqMt/fVsS8HHHbc/09
TLSH
T12952FA126A349A77CCDBD609FA51BB53D7F5153292910E5499FCC90C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f579c6ba0bad34290661a041663da8e189180c3306b71c66ff932e731f236e23
MD5 143539a0e9b2426e3566bcb9b9d7f002
SHA1 65bd21a97c03e8033714ac61838175c732e3e593
SHA512 94fd003c70b4545ff047fe6b3bbfcf948fb8b291a43311e84865515fae9f71ec7e71e2b763db20cb38a7ddc71b8ff62f4aa4c9806efeb4f84ac629f401f94bc3
SSDEEP 192:sxZpR8yM/jK1Ml8UQfkt/fVscvey7IdpiKg/ElHW6+WNn5m1Y9IRBLPIg5yJ:sxZpqqMt/fVscveHtHbQ1ns
TLSH
T10652FA126A389A77CCDBDA0DF641BB53E7F5147292910E4899FCC91C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e24de21282dcc01c331eda3aba45ec37e8888463c17b3ea807092364a0111138
MD5 9964d0424ba3a763637b9f6a78e086c2
SHA1 479b35eb88aefbd537d49d95de12a9668eb194f2
SHA512 b7c60082e33d6921a4afc0b65ce23dafb5a3753aaa292d47aefc0c72a0421a9f5d6616f2d23c8de04ac4ce1bb31fa61a1623c4f0433d43de01b1685b144d7a69
SSDEEP 768:tScv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNuroig6N:tScv21wWvu+Z+u1jaeFLeRNli9
TLSH
T1EDD20A2B280CCB7E4F841E9CED2A6F9B6DD801CB56988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6a293053-176f-4c79-a656-9a619e7ce199\index-dir\temp-index
Size 2KB
SHA256 40093a73a9e2309c660876296ff385f144bc8873ae6b83e30f6995638c519d26
MD5 e50578ed26f9de069f7747bcce8ff2e5
SHA1 f2803de7beb6703c6b57dfd91da070ece67b75b7
SHA512 aac8a006042e4651de91de8c344a1a1ec246ec20171593925dfcb8c935ab4e02372990d35dc4f98cb18d3f69ae9f5efa38b627c521e177a8245272dfd4a91a24
TLSH
T14451514CC8806BADE87161BE29D015F293753C38FC6CC7918198B5B13413A692B47EFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6a293053-176f-4c79-a656-9a619e7ce199\index-dir\the-real-index
Size 2KB
SHA256 a5c3690e0f649684fe049f609ae88632c71e4dd5ef758c97d2fbee1067227be4
MD5 f71fc613fdb328998641d0ac3bc893d7
SHA1 8063d2bb27de26993657e7ea09c51e43300d9e4d
SHA512 55ee327fceae5b3c7c75e2504210a4a5d7b6fee842584539954234d68bf99d0ee935028bd6ebdda90962ef4e85a4f96a0e657f209f0a18058ad96b637a492840
TLSH
T10351654CC98067AED87551BD2D9415F253752C38FC59C3A28198B1B234436681B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f5a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6a293053-176f-4c79-a656-9a619e7ce199\index-dir\the-real-index~RFe58f5a6.TMP
Size 48B
SHA256 c49921a51d0668a8ec94d4252736b12e69416f29d5877a4619a8e67df2d079c9
MD5 adb15ba80bead03f378aa6093afeaa25
SHA1 d1fd2990a5aad8756aabc7ecff4ee8086628d7c6
SHA512 d03ca9d59370c5762294d868fde2cae821d8f5967f9f6447f6e46ec34f6990ebb206c930c4598c4cb28a3d526758d607e16d9a342d179895736b8399208601e0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 ecc183190cc5b5683bc771c5717528923d8929cf23685a05d196aee8fbfd4830
MD5 42686927d4a46f561a6b18c10f9fc3b8
SHA1 e264840e88d44a7bb561fe2ab3dc9ae0ff81256e
SHA512 a1099a69e237b22b7c26273856e2253851a5dabc78288247993aebea75f6acb8b9f363495cbc690a884a154332e9b85cbbd0d6fab455b1dc2cbd02851320a25e
TLSH
T1E3D023D603779DD55A3CDF85713C114D411E8F58DD40C8E89818B06620B4606C40B57C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 fca115e7b81cef48ae8520cc915bbe34b90652b5ab4fc9c33fc8867bebe87a69
MD5 d32859fd4904371750834bf4b491b6df
SHA1 b596df988e62044d365374c916a6d77bab7d152e
SHA512 688a621b42addbf499d6988249b9ea056fbd6265f457777ed1d3fc79015ad83b7562aa434efe6a1c44fafc38c3f2ce92b33d335b65017721ea81b2cec4a147fe
TLSH
T136C09BE315558ADA0E7CEFC91138661D951F465CC9D0CCE8A41494416074917444B639
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 f46c4b9518ff23181512d1c4b631be13a7d07a18443f3b5cfc21b7180bcdf882
MD5 62629dddf671eb6347c0122710fd56cb
SHA1 3e23cac33a21b932455eb21fadcc746f13af47c2
SHA512 ef5f41e706720ed9e0e6b7665a3616ebb28d80e5a01d891e4e5ff8cf89a603d1daf3bef5204546a7bf39536a33c676eb6e14a9400470426b0fedafddba84550e
TLSH
T16BC09BE325554ED60E78EBC92138661D955F855CCDD0CCE8B81494426174917440B639
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 fe1ae0758978dd9b843df7bdaa1e4cee485ab9ba10993fbc4bd29273678ace13
MD5 a132ef3591202b93457afd4610b247a7
SHA1 a4ba4ed4b2199a5e39915e699fcd731dd47e3dfc
SHA512 b9e2f24dbfcecc54024e7a4c6e506e42fa21cb4389eb1cc59d69bdeec7b6f7cafc04847a19000288974b130ed69b7a9af9a1933cfcd4d254fa1a4eac1b4fd541
TLSH
T1A9C09BE325554AD60E78EBC92138662D951FC55CC9D4CCE8A41494416074A17440B639
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589c7a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe589c7a.TMP
Size 137B
SHA256 b9dfa9ed3bbfa600f2be857600a7fd307bf5d5f0999aaf8b1da0fe9d3354c525
MD5 16498cc37ecfad3fc0d1ed8d756cc1ec
SHA1 ad1d04663ebd692d64b105698c0c14cf6392dc16
SHA512 b6df773123f10c7dabea33f89d1c5764275772a996d2d45b115898ca19d8352e426acd61a4b501ce81b8b97365ed34cffaab7855032876b90aa13dabc6a69ad4
TLSH
T10AC09BE315654AD60F38AAC55138665D951F4D9CCDC0CCECA415B541707491F950F639
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ff6f39307d2fd923b989ffc17d29e735bf02061fe28b29ad4086b94cc6459b69
MD5 0facd00108e508782b5e33b37a526630
SHA1 32189b5384349d9d2e3ebc6d8a569cafb56d4ea8
SHA512 6e7ea659fea0182ca6bb25881434ef65ab9b0b1beccfaf360012ba0eec507026ebfa409a2eef6b74121d39e4054107f59b55a2a1c173dc3bf8ea5c8b2ba8a7e7
TLSH
T16BA00214028E2011C85006F01B4A314D23514CA20122126545E9E0D9ED919D5754D101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eb26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58eb26.TMP
Size 48B
SHA256 82937004b259e8c31e4fb699fc101b8c9449e1aa53db5389eba5cd6a104824fe
MD5 69cb915313e5fbd8205be1fb01eb39fe
SHA1 b5a5bb0e336a8e378f1b63e9b03f7fa05e0835db
SHA512 f3bd682766cd025fd9a13aa7fcbcee3afda3b3fe16182275e811fc8266b76e762363c55192a95b2e9d2f975116f020a245a471e368d78df20575cff8f4f66bfc
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 49226112bcc6b1cf0b391aff8858c5f06efa70deebdf9d040affb7cfe3a8d165
MD5 282a76c88e47d8e9cfdc039ee67d5416
SHA1 32407a636ac08671b39c771c0e3f38591f773b45
SHA512 5d3515e242c2a91f76c71078d076c8d25588b59841c9f9694fbc10ce3b19d17c6f8660faf53f7f1e22c4257dfea8f43af0a726d67445545da1a6c818461eeb3f
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+VJ2KiMKSMgK1e+:mTXFzr
TLSH
T104913E1230BB02513CFF6D0CAAD7952A1B4170673658E93B7BBA00A64B67E149CFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8a9ad09-7254-40c9-bf04-aaf14c8588e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8a9ad09-7254-40c9-bf04-aaf14c8588e3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 39e7bceb2009f998539fc3860cb30e7224eea5040a3bcca23697aa90468ad284
MD5 f58664f0212f413afebd715cb40ecf7c
SHA1 112c71c45e8d7af9e1cd67c0184779839168e4d4
SHA512 3f188aa6d20e3521cb958191fa67849579b22a72bb25d7d44b6b118d94a0e7c4090d4e517d324d2811c7251c477f5814de24ca74b48be66ab5f2dbe6f1fd8b01
SSDEEP 192:uFLsN7CQeJPv8+YLegSQmiU1z/zm4e+CGy+FdeL9oCd1FS+2YJJicqXU8:msN7C1JX8zi39zpe+CMdceCBS+2rNU8
TLSH
T1B1322A32AC385C3B4EE2A951F54736139FB85167EA863F90D5EC9F1C01DF6AC230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ce8cb63d87d9a1e32317194ed2ee6b1e00915b75a2790adc2b1f630f1a52c170
MD5 13fda96421d811d68289dc3714971f53
SHA1 343a10bda40f638ce5f3265b5863967442ebc391
SHA512 862cca878ae97e55fe69f294a35b759a905d7fd7de6a9c70cd50899c348ac279a2857b9aca2adebfcafb5d6f667f257d247e07f153066c732eda92a493409831
SSDEEP 384:JqZcIe/sN7sD1JX8zi3ezpe+CMdceCBS+28NivluYoC:KaNJ49zwklCcl8Ni9uYh
TLSH
T1CEB2F6F158E75836C9AD9743A77E2D134E7CC063B5862A40B3D89B1CCC9A5BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be18008b2f3407e377c08e627d55040a850ea863c1a55bf4da435040518c9483
MD5 1d9e4cef8fc1b08e26d61b2b387f8c27
SHA1 95a67f7d12a4b5c777bc4f7680637e2272c865b4
SHA512 20d544ae0802bcc9a24cf5e320316279a63fad4fd91ce106feccd1f81323fb2309a2bfff8bb7a4ce294eb75a548b873568f893107fa2bc4ec64f26a7985bae4c
SSDEEP 192:JONU6v+YLNQmiUy+/hZh+CGy+FdeL9oCXusnfU6:JONU6vz/vhZh+CMdceCDfU6
TLSH
T1B002D8356D382C7B9FF2AE45F5873A235FA82177E9922F84D9E81B0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fb8643df515168d4bff54153b590bcf473daea509ca76fc3785fe3ca5fa301fa
MD5 b7ec2fafff357349c90bf90b034afe0e
SHA1 4edca66baa16afaccd24aa1d22ed0ab631e00ab7
SHA512 13b3bd9662d328981555cc8be53419b519c0c13f6b2a1f977c09d9b9f9e6c7727ea4cb16042701717e45c770a98b63d457698e4dfb8337f70c0bcaf170f106e5
SSDEEP 384:dZcIhsN7sD1JX8zi39zpe+CMdceCBS+2rNivluYoC:FhNJ4yzwklCclrNi9uYh
TLSH
T187828C725C385C7B1DE6D540FA4735139FB89063EACA2F8094ECEB2D01DEAA9130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8acf3c10fb885b8c170697b3a61e663bee1c0a0a44ecb7fae90a180e00d94f8
MD5 d0af7cfe567dc7b75943f9ce51ece2d7
SHA1 4219bc35002c64ec40235304c698f484e163761b
SHA512 769c3bcdfdab528ad813dae276e274b30c8aef594100aa1688279a61d931e5bd38a946c85260f2a3c7891c89dc1a21508c6889d0e28458466219524d907582f6
SSDEEP 192:DONe6v+YLuQmiUyB/hLh+CGy+FdeL9oCd1FS+2/CHcqXU6:DONe6vz+6hLh+CMdceCBS+2UNU6
TLSH
T12B122C36AC385C7B5EE26945F48335135FA45267EE863F80D5EC6F1C02DF6AC134A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d97e22de-52f7-45ed-9a48-a091e6a6b457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d97e22de-52f7-45ed-9a48-a091e6a6b457.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download